RHSA-2020:2670MediumCVSS 7.3

Red Hat Security Advisory: pcs security and bug fix update

Published
June 23, 2020
Last Modified
August 4, 2026

🔗 CVE IDs covered (1)

CVE-2020-10663 →

📋 Description

CVE-2020-10663 — rubygem-json: Unsafe object creation vulnerability in JSON

🎯 Affected products18

  • Red Hat Enterprise Linux High Availability EUS (v. 8.1)
  • Red Hat Enterprise Linux Resilient Storage EUS (v. 8.1)
  • pcs-0:0.10.2-4.el8_1.1.aarch64 as a component of Red Hat Enterprise Linux High Availability EUS (v. 8.1)
  • pcs-0:0.10.2-4.el8_1.1.ppc64le as a component of Red Hat Enterprise Linux High Availability EUS (v. 8.1)
  • pcs-0:0.10.2-4.el8_1.1.ppc64le as a component of Red Hat Enterprise Linux Resilient Storage EUS (v. 8.1)
  • pcs-0:0.10.2-4.el8_1.1.s390x as a component of Red Hat Enterprise Linux High Availability EUS (v. 8.1)
  • pcs-0:0.10.2-4.el8_1.1.s390x as a component of Red Hat Enterprise Linux Resilient Storage EUS (v. 8.1)
  • pcs-0:0.10.2-4.el8_1.1.src as a component of Red Hat Enterprise Linux High Availability EUS (v. 8.1)
  • pcs-0:0.10.2-4.el8_1.1.src as a component of Red Hat Enterprise Linux Resilient Storage EUS (v. 8.1)
  • pcs-0:0.10.2-4.el8_1.1.x86_64 as a component of Red Hat Enterprise Linux High Availability EUS (v. 8.1)
  • pcs-0:0.10.2-4.el8_1.1.x86_64 as a component of Red Hat Enterprise Linux Resilient Storage EUS (v. 8.1)
  • pcs-snmp-0:0.10.2-4.el8_1.1.aarch64 as a component of Red Hat Enterprise Linux High Availability EUS (v. 8.1)
  • pcs-snmp-0:0.10.2-4.el8_1.1.ppc64le as a component of Red Hat Enterprise Linux High Availability EUS (v. 8.1)
  • pcs-snmp-0:0.10.2-4.el8_1.1.ppc64le as a component of Red Hat Enterprise Linux Resilient Storage EUS (v. 8.1)
  • pcs-snmp-0:0.10.2-4.el8_1.1.s390x as a component of Red Hat Enterprise Linux High Availability EUS (v. 8.1)
  • pcs-snmp-0:0.10.2-4.el8_1.1.s390x as a component of Red Hat Enterprise Linux Resilient Storage EUS (v. 8.1)
  • pcs-snmp-0:0.10.2-4.el8_1.1.x86_64 as a component of Red Hat Enterprise Linux High Availability EUS (v. 8.1)
  • pcs-snmp-0:0.10.2-4.el8_1.1.x86_64 as a component of Red Hat Enterprise Linux Resilient Storage EUS (v. 8.1)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this vulnerability, do not supply untrusted user input and/or untrusted strings to the following method calls or utilize code libraries which do so: ``` JSON(user_input) JSON[user_input, nil] JSON.parse(user_input, nil) JSON::Parser.new(user_input).parse ``` Also note that JSON.load() should never be given input from unknown sources.

🔗 References (5)